Best Practices for Entity Types - Particularly when retiring and reactivating Entities

[ChristopherS131]

I'm looking for guidance and best practices for managing Entity Types, particularly when entities are retired and later reactivated.

My organization uses Entity Types that can have dozens of associated controls/risks (sometimes 40+). Over time, hundreds of entities have been created in advance of being assessed. Because these unassessed entities remain at their inherent risk scores, they are skewing our overall risk heat map and reporting.

The proposed solution is to retire and inactivate unassessed entities and reactivate them when they are ready to be assessed. My concern is how this impacts Entity Type inheritance and synchronization, particularly since my organization has made changes to Entity Types in the past by both adding and removing controls objectives/risk statements from them.

What I've observed:

• Changes made to an Entity Type are not reflected in inactive entities. When an entity is reactivated, it does not appear to automatically pick up changes made to its Entity Type while inactive.
• Removing and re-adding the Entity Type will add any controls/risks the entity is missing
• Conversely, removing and re-adding the Entity Type fails to consistently retire controls/risks that were removed from the Entity Type:
  • Sometimes a control is retired but the corresponding risk remains active.
  • Sometimes a risk is retired but the corresponding control remains active.
  • In both cases above, neither the controls nor the risks were added directly to the entity; the controls were originally inherited from the Entity Type.
• Overall, the results seem inconsistent and difficult to predict.

I've been unable to find clear ServiceNow documentation on recommended practices for Entity Type lifecycle management. Specifically, I'm trying to understand:

1. Is it considered a best practice to retire and later reactivate entities, or is there a better approach for entities that won't be assessed for some time?
2. Are Entity Types intended to remain relatively static once entities have been created from them, or are ongoing modifications expected?
3. Is there a recommended process to ensure reactivated entities properly reflect changes made to their Entity Type while inactive?
4. Are there practical limits or recommendations regarding the number of controls/risk statements associated with a single Entity Type?

I'd appreciate any lessons learned, real-world experience, or links to documentation that would assist with my question.